Add student account self-service security features and discoverability fixes; v2.1.0

Adds forgot/reset password, signup email verification, sign-out-of-all-devices,
note-usage and certificate display in account settings, and password-changed
security emails. Fixes study sessions being lost on server restart by
persisting them to disk, and fixes sanitizeStudyUsers silently dropping the
new pending-token fields on load. Also surfaces the lesson discussion board
in the main site nav, trims the sign-in page for returning users, and renames
colossiansStudy.tsx/colossiansStudyData.ts to studyPages.tsx/legacyColossiansData.ts
now that the study system covers more than Colossians.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/AdminPage.tsx

@@ -481,6 +481,24 @@ function EmailTemplatesPanel({
         fieldKeys={['emailChangeSubject','emailChangeBody','emailChangeCtaLabel']}
         openKey="email-change" />
 
+      <EmailTemplateCard type="transactional" icon="✅" title="Account Security — Verify Email Address"
+        trigger="A student creates a study account (sent alongside the welcome email)"
+        autoVars="Student's display name, button links to a one-time verification URL (auto-generated, expires in 7 days, not editable)"
+        fieldKeys={['emailVerifySubject','emailVerifyBody','emailVerifyCtaLabel']}
+        openKey="email-verify" />
+
+      <EmailTemplateCard type="transactional" icon="🔑" title="Account Security — Password Reset"
+        trigger="A student requests a password reset from the sign-in page"
+        autoVars="Student's display name, button links to a one-time reset URL (auto-generated, expires in 1 hour, not editable)"
+        fieldKeys={['passwordResetSubject','passwordResetBody','passwordResetCtaLabel']}
+        openKey="password-reset" />
+
+      <EmailTemplateCard type="transactional" icon="🛡️" title="Account Security — Password Changed"
+        trigger="A student's password is changed (self-service reset, in-account change, or admin reset) — confirms the change and that other sessions were signed out"
+        autoVars="Student's display name, link to account settings"
+        fieldKeys={['passwordChangedSubject','passwordChangedBody']}
+        openKey="password-changed" />
+
       <EmailTemplateCard type="transactional" icon="📟" title="Two-Factor Auth — Email Sign-In Code"
         trigger="A student with email-based 2FA signs in, or requests a resend during login"
         autoVars="The 6-digit code is auto-generated and inserted between the body text and expiry note — not editable"
@@ -1004,6 +1022,14 @@ const FIELDS: Array<{ key: StringField; label: string; multiline?: boolean; sect
   { key: 'emailChangeSubject', label: 'Subject Line', section: 'email-templates' },
   { key: 'emailChangeBody', label: 'Body Text', multiline: true, section: 'email-templates' },
   { key: 'emailChangeCtaLabel', label: 'Button Label', section: 'email-templates' },
+  { key: 'emailVerifySubject', label: 'Subject Line', section: 'email-templates' },
+  { key: 'emailVerifyBody', label: 'Body Text', multiline: true, section: 'email-templates' },
+  { key: 'emailVerifyCtaLabel', label: 'Button Label', section: 'email-templates' },
+  { key: 'passwordResetSubject', label: 'Subject Line', section: 'email-templates' },
+  { key: 'passwordResetBody', label: 'Body Text', multiline: true, section: 'email-templates' },
+  { key: 'passwordResetCtaLabel', label: 'Button Label', section: 'email-templates' },
+  { key: 'passwordChangedSubject', label: 'Subject Line', section: 'email-templates' },
+  { key: 'passwordChangedBody', label: 'Body Text', multiline: true, section: 'email-templates' },
   { key: 'twoFaOtpEmailSubject', label: 'Subject Line', section: 'email-templates' },
   { key: 'twoFaOtpEmailBody', label: 'Body Text (shown above the code)', multiline: true, section: 'email-templates' },
   { key: 'twoFaOtpEmailExpiry', label: 'Expiry / Security Note (shown below the code)', multiline: true, section: 'email-templates' },